mv hosts nixosConfigurations

nixosConfigurations/vinzenz-lpt2/configuration.nix

@@ -0,0 +1,45 @@
+{ ... }:
+{
+  imports = [ ./nginx.nix ];
+
+  config = {
+    nix.settings.extra-platforms = [
+      "aarch64-linux"
+      "i686-linux"
+    ];
+
+    services.xserver.xkb = {
+      # Configure keymap in X11
+      layout = "de";
+      variant = "";
+    };
+
+    # Configure console keymap
+    console.keyMap = "de";
+
+    users.users.vinzenz.openssh.authorizedKeys.keys = [
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
+      ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
+    ];
+
+    #users.users.ronja.openssh.authorizedKeys.keys = [
+    #  ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
+    #];
+
+    programs = {
+      adb.enable = true;
+      light = {
+        enable = true;
+        brightnessKeys = {
+          enable = true;
+          step = 5;
+        };
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [
+      8776
+      1337
+    ];
+  };
+}

nixosConfigurations/vinzenz-lpt2/hardware.nix

@@ -0,0 +1,63 @@
+{ lib, ... }:
+{
+  imports = [ ../../modules/intel-graphics.nix ];
+  config = {
+    # intel cpu
+    boot.kernelModules = [
+      "kvm-intel"
+      "xe"
+    ];
+    hardware.cpu.intel.updateMicrocode = true;
+
+    boot.loader = {
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+
+    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+    # (the default) this is the recommended approach. When using systemd-networkd it's
+    # still possible to use this option, but it's recommended to use it in conjunction
+    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+    networking.useDHCP = lib.mkDefault true;
+
+    hardware.enableRedistributableFirmware = true;
+
+    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+    boot.initrd = {
+      availableKernelModules = [
+        "xhci_pci"
+        "thunderbolt"
+        "nvme"
+      ];
+      luks.devices = {
+        "luks-2c654ff2-3c42-48d3-a1e3-9545679afaa3" = {
+          device = "/dev/disk/by-uuid/2c654ff2-3c42-48d3-a1e3-9545679afaa3";
+        };
+      };
+    };
+
+    fileSystems = {
+      "/" = {
+        device = "/dev/disk/by-uuid/e4dad0c8-26a1-45e9-bbd9-48565eb6574e";
+        fsType = "btrfs";
+        options = [ "subvol=@" ];
+      };
+
+      "/boot" = {
+        device = "/dev/disk/by-uuid/E2B7-2BC1";
+        fsType = "vfat";
+      };
+    };
+
+    swapDevices = [
+      {
+        device = "/var/lib/swapfile";
+        size = 32 * 1024;
+      }
+    ];
+
+    services.thermald.enable = true;
+    services.hardware.bolt.enable = true; # thunderbolt security
+  };
+}

nixosConfigurations/vinzenz-lpt2/imports.nix

@@ -0,0 +1,15 @@
+{ nixosModules, ... }:
+{
+  imports = [
+    ../../modules/gnome.nix
+    ../../modules/gaming.nix
+    nixosModules.steam
+    nixosModules.printing
+    nixosModules.podman
+    ../../modules/desktop-environment.nix
+    ../../modules/desktop-hardware.nix
+
+    ../../home/vinzenz
+    ../../home/ronja
+  ];
+}

nixosConfigurations/vinzenz-lpt2/nginx.nix

@@ -0,0 +1,66 @@
+{ pkgs, ... }:
+let
+  blog-domain-socket = "/run/nginx/blog.sock";
+  anubis-domain-socket = "/run/anubis/anubis-blog.sock";
+in
+{
+  users.groups = {
+    anubis.members = [ "nginx" ];
+    nginx.members = [ "anubis" ];
+  };
+  services = {
+    nginx = {
+      enable = true;
+
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+
+      virtualHosts = {
+        #"vinzenz-lpt2" = {
+        #  locations."/" = {
+        #    proxyPass = "http://127.0.0.1:3000/";
+        #    proxyWebsockets = true;
+        #  };
+        #
+        #  serverAliases = [ "172.23.42.96" ];
+        #};
+
+        "vinzenz-lpt2" = {
+          locations."/" = {
+            proxyPass = ("http://unix:" + anubis-domain-socket);
+          };
+        };
+
+        "vinzenz-lpt2-in-anubis" = {
+          root = pkgs.zerforschen-plus-content;
+          listen = [
+            {
+              addr = ("unix:" + blog-domain-socket);
+            }
+          ];
+        };
+      };
+    };
+
+    #networking.firewall = {
+    #  allowedTCPPorts = [
+    #    80
+    #    8001
+    #    3000
+    #  ];
+    #  allowedUDPPorts = [ 2342 ];
+    #};
+
+    anubis = {
+      instances.main = {
+        enable = true;
+        settings = {
+          BIND = anubis-domain-socket;
+          TARGET = "unix://" + blog-domain-socket;
+        };
+      };
+    };
+  };
+}

nixosConfigurations/vinzenz-lpt2/zerforschen-plus.nix

@@ -0,0 +1,38 @@
+{
+  pkgs,
+  ...
+}:
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "acme@zerforschen.plus";
+  };
+
+  security.pam.services.nginx.setEnvironment = false;
+  systemd.services.nginx.serviceConfig = {
+    SupplementaryGroups = [ "shadow" ];
+  };
+
+  services.nginx = {
+    enable = true;
+    additionalModules = [ pkgs.nginxModules.pam ];
+
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+
+    virtualHosts = {
+      "zerforschen.plus" = {
+        #addSSL = true;
+        #enableACME = true;
+        root = pkgs.zerforschen-plus-content;
+      };
+    };
+  };
+
+  #networking.firewall.allowedTCPPorts = [
+  #  80
+  #  443
+  #];
+}